EP2859673B1 - Utilisation de niveaux de sécurité dans un réseau optique - Google Patents
Utilisation de niveaux de sécurité dans un réseau optique Download PDFInfo
- Publication number
- EP2859673B1 EP2859673B1 EP12726454.7A EP12726454A EP2859673B1 EP 2859673 B1 EP2859673 B1 EP 2859673B1 EP 12726454 A EP12726454 A EP 12726454A EP 2859673 B1 EP2859673 B1 EP 2859673B1
- Authority
- EP
- European Patent Office
- Prior art keywords
- node
- security
- path
- optical
- nodes
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Not-in-force
Links
- 230000003287 optical effect Effects 0.000 title claims description 111
- 238000012544 monitoring process Methods 0.000 claims description 41
- 238000000034 method Methods 0.000 claims description 40
- 238000004891 communication Methods 0.000 claims description 28
- 230000001419 dependent effect Effects 0.000 claims description 3
- 230000004044 response Effects 0.000 claims description 3
- 239000000470 constituent Substances 0.000 claims description 2
- 208000010119 wrinkly skin syndrome Diseases 0.000 description 12
- 239000000835 fiber Substances 0.000 description 10
- 230000000903 blocking effect Effects 0.000 description 9
- 238000010200 validation analysis Methods 0.000 description 9
- 238000012545 processing Methods 0.000 description 8
- 230000009471 action Effects 0.000 description 7
- 230000006870 function Effects 0.000 description 6
- 230000008859 change Effects 0.000 description 4
- 230000000052 comparative effect Effects 0.000 description 4
- 230000011664 signaling Effects 0.000 description 3
- 238000013459 approach Methods 0.000 description 2
- 230000008901 benefit Effects 0.000 description 2
- 230000008878 coupling Effects 0.000 description 2
- 238000010168 coupling process Methods 0.000 description 2
- 238000005859 coupling reaction Methods 0.000 description 2
- 238000001514 detection method Methods 0.000 description 2
- 230000002452 interceptive effect Effects 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 230000008569 process Effects 0.000 description 2
- 230000003595 spectral effect Effects 0.000 description 2
- 238000001228 spectrum Methods 0.000 description 2
- 238000012546 transfer Methods 0.000 description 2
- 230000001131 transforming effect Effects 0.000 description 2
- RYGMFSIKBFXOCR-UHFFFAOYSA-N Copper Chemical compound [Cu] RYGMFSIKBFXOCR-UHFFFAOYSA-N 0.000 description 1
- 230000009118 appropriate response Effects 0.000 description 1
- 230000002457 bidirectional effect Effects 0.000 description 1
- 230000005540 biological transmission Effects 0.000 description 1
- 230000001427 coherent effect Effects 0.000 description 1
- 230000000295 complement effect Effects 0.000 description 1
- 238000013461 design Methods 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 230000036039 immunity Effects 0.000 description 1
- 230000010365 information processing Effects 0.000 description 1
- 230000000977 initiatory effect Effects 0.000 description 1
- 230000010354 integration Effects 0.000 description 1
- 238000010297 mechanical methods and process Methods 0.000 description 1
- 239000013307 optical fiber Substances 0.000 description 1
- 230000000737 periodic effect Effects 0.000 description 1
- 235000013550 pizza Nutrition 0.000 description 1
- 238000011084 recovery Methods 0.000 description 1
- 238000010079 rubber tapping Methods 0.000 description 1
- 238000012795 verification Methods 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L45/00—Routing or path finding of packets in data switching networks
- H04L45/42—Centralised routing
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1433—Vulnerability analysis
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04J—MULTIPLEX COMMUNICATION
- H04J14/00—Optical multiplex systems
- H04J14/02—Wavelength-division multiplex systems
- H04J14/0227—Operation, administration, maintenance or provisioning [OAMP] of WDM networks, e.g. media access, routing or wavelength allocation
- H04J14/0254—Optical medium access
- H04J14/0267—Optical signaling or routing
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
Definitions
- This invention relates to methods of path computation through nodes of a communications network, to methods of validating a chosen path meets a desired security level, to methods of reporting a current security level at a node to a record at a centralised location, to nodes of a communication network configured to carry out such methods or to cooperate with a remote path computation element to validate a chosen path, and to signals having an indication of a security level of an optical path from an ingress node to an egress node in an optical communications network.
- optical layer security benefits from electromagnetic immunity however the optical layer includes not only fiber spans but also network equipments which are vulnerable to a variety of attacks. This means that optical networks can be almost as easy to tap or to interfere as copper wire based networks.
- optical encryption of the signals transmitted across an optical communications network
- Jung et al "Demonstration of 10Gbps all-optical encryption and decryption system utilizing SOA XOR logic gates", Optical and Quantum Electronics, vol. 40, no. 5-6, April 2008 .
- a problem faced by optical encryption is that optical encryption and decryption devices are required for each wavelength channel at each transmitter and receiver within a communications network, raising the cost of the network.
- AUDOUIN O ET AL "Service level agreement and provisioning in optical networks", IEEE COMMUNICATIONS MAGAZINE, IEEE SERVICE CENTER, PISCATAWAY, US, vol. 42, no. 1, 1 January 2004 (2004-01-01), pages 36-43, XP011105972, ISSN: 0163-6804 describes a service level agreement applied to the optical domain (O-SLA). Parameters that could be included in this O-SLA, as well as their values for four classes of services, arc proposed. Different client (wavelength or subwavelength) and service types (from leased wavelength to bandwidth on demand) are distinguished when necessary.
- WO2011103930 One known approach shown in WO2011103930 is concerned with the vulnerability of optical monitoring points in the communications network. These monitoring points are intended for monitoring optical spectrum and power but may be vulnerable to unauthorised eavesdropping. They typically comprise an optical splitter arranged to extract between 1% and 10% of the optical signal that is to be monitored, the extracted signal being provided to a monitoring port. All of the traffic carried by the optical signal being monitored is replicated in the extracted signal and is provided to the monitoring port. There is a resulting problem that live traffic is vulnerable to eavesdropping at the monitoring port and this presents a problem of communications network security.
- ITU-T X.805 "Security architecture for systems providing end-to-end communications" sets out various optical protection schemes for making an optical connection secure against a fibre being cut to place an in-line tap for eavesdropping.
- the methods set out in ITU-T X.805 only monitor cuts in an optical communications network fibre link and are not able to detect eavesdropping of an optical signal via a monitoring port.
- Optical signal transforming apparatus is arranged to receive the tapped signal and to apply an optical transfer function to the tapped signal to form an optical monitoring signal.
- the optical transfer function is arranged to preserve the spectral property of the tapped signal and to apply a time-domain obfuscation to the tapped signal.
- the optical signal transforming apparatus is further arranged to provide the optical monitoring signal to the monitoring port.
- an optical monitoring signal from an input optical signal or an output optical signal may be formed on which the traffic is obfuscated in the time-domain and in which a spectral property of the input optical signal or the output optical signal is preserved. Therefore it becomes difficult or impossible for traffic on the input signal or the output signal to be intercepted by eavesdropping on the optical monitoring signal, without the need for encryption of each wavelength channel.
- a first aspect of the invention provides a method of path computation through nodes of an optical communications network.
- a second aspect of the invention provides a method of validating a chosen path through nodes of an optical communications network.
- a third aspect of the invention provides a method of reporting a current security level at a node to a record of a connectivity of nodes and links of an optical communications network.
- a fourth aspect of the invention provides apparatus configured to carry out the method of the first or third aspects.
- a fifth aspect provides a node of an optical communications network configured to cooperate with a remote path computation element.
- a sixth aspect provides a signal having an indication of a security level of an optical path.
- Elements or parts of the described nodes or networks may comprise logic encoded in media for performing any kind of information processing.
- Logic may comprise software encoded in a disk or other computer-readable medium and/or instructions encoded in an application specific integrated circuit (ASIC), field programmable gate array (FPGA), or other processor or hardware.
- ASIC application specific integrated circuit
- FPGA field programmable gate array
- references to nodes can encompass any kind of switching node, not limited to the types described, not limited to any level of integration, or size or bandwidth or bit rate and so on.
- switches can encompass switches or switch matrices or cross connects of any type, whether or not the switch is capable of processing or dividing or combining the data being switched.
- references to programs or software can encompass any type of programs in any language executable directly or indirectly on processing hardware.
- references to processors, hardware, processing hardware or circuitry can encompass any kind of logic or analog circuitry, integrated to any degree, and not limited to general purpose processors, digital signal processors, ASICs, FPGAs, discrete components or logic and so on. References to a processor are intended to encompass implementations using multiple processors which may be integrated together, or co-located in the same node or distributed at different locations for example.
- the functionality of circuits or circuitry described herein can be implemented in hardware, software executed by a processing apparatus, or by a combination of hardware and software.
- the processing apparatus can comprise a computer, a processor, a state machine, a logic array or any other suitable processing apparatus.
- the processing apparatus can be a general-purpose processor which executes software to cause the general-purpose processor to perform the required tasks, or the processing apparatus can be dedicated to perform the required functions.
- Embodiments can have programs in the form of machine-readable instructions (software) which, when executed by a processor, perform any of the described methods.
- the programs may be stored on an electronic memory device, hard disk, optical disk or other machine-readable storage medium or non-transitory medium.
- the programs can be downloaded to the storage medium via a network connection.
- ports are intended to encompass any kind of port, examples include, and are not limited to, optical connectors for internal or external coupling, connectors for coupling between cards and motherboards, fiber tails with no termination, for future splicing, cards having such connectors or fibers and associated circuitry or components, ports provided for monitoring optical spectrum, or for future expansion or reconfiguration, or because the commercially available optical branching components do not provide the desired number of outputs, and so on.
- references to access to a path are intended to encompass any kind of physical access which could affect signals on the path, for an optical path this can encompass connecting to an optical connector or splicing a fiber tail or tapping a proportion of the optical power, so that optical signals on the optical path can be received, or so that interfering optical signals can be added to the optical path.
- ROADM architectures allow nodes with different functionalities such as the Colored/Colorless, Directionbound/Directionless, Contentionless, etc. All these architectures show a certain degree of vulnerability in terms of ease of access to optical unused ports where the optical signal carrying a large amount of traffic can be tapped or accessed and no means of detecting the malicious intrusion are available now.
- Some of the vulnerable points of these architectures include:
- the security measures can include changes to software/firmware for controlling the node, and/or to additional hardware for blocking unused ports. For example, for nodes of optical networks having multiple WSSs, each wavelength may be split and distributed to the WSSs, and blocked at all but one of the WSSs to control which direction the wavelength is output. Software/firmware is provided in charge of commanding each WSS to block or not block a specific channel, depending of the desired outbound port. Security measures can be provided to guard against altering or hacking of such software/firmware.
- the blocking capability of a WSS can be assured by a proper SW design where any change of status of a WSS port is not allowed if no traffic is configured for this port/channel and can be enforced by adapting the WSS control software/firmware to report any change of status so that repudiation of the action cannot be done.
- Other security measures can involve using electro-mechanical methods or involve monitoring a blocking part used to occupy unused ports which would otherwise be vulnerable to eavesdropping. This can be based on a 'security guard unit' which enables a ROADM node to certify that a light-path crossing the node itself has not been spilled, tapped, dropped or interfered with in any way. Any points of 'weakness' and vulnerable points of access for a malicious operator can be monitored.
- Figure 1 shows a schematic view of a number of nodes and links of a communications network, using optical or other technologies.
- Four rows of four nodes are shown, but in a typical network there may be many more and arranged in different types of topologies (e.g. rings, trees).
- the nodes are of two types, insecure nodes 10 and secure nodes 20.
- the insecure nodes either have no security capability, or have the capability but the monitored status of the security is that the security has been breached.
- the nodes report their security capability or security status of the node or parts of the node or links, to a database 110 having a record of network connectivity and security indications.
- a path computation entity PCE 100 can calculate paths for new traffic requests or for on the fly recovery of traffic impacted by a failure, based on the security indications in the database.
- the PCE and record can be centralised or duplicated at a local level at each node following established principles.
- the PCE and record can be within or separate to a network management system NMS 130, and the NMS can be part of or integrated with a control plane 120.
- the NMS can be centralised or at least partly distributed amongst the nodes.
- the control plane 120 can provide the communications between the nodes and the PCE and record, or such communications can be provided separately.
- the PCE can be implemented as a processor configured to execute programs in the form of software or firmware. It can be shared with other functions by time slicing, or be a dedicated processor for PCE for example.
- the dotted lines show two possible paths selected by the PCE for a traffic request between a top left node which can be regarded as an ingress node, and a top right node which can be regarded as an egress node.
- the upper of the two paths passes along the top row of nodes which is the shortest path, based on the connectivity in the record, regardless of the indications of security level. If the traffic request needs a particular level of security, then the path computation can be carried out using the indications of security level in the record. This might result in the PCE selecting the lower path as shown, which passes along a second row of nodes which is the shortest path using only nodes indicated as secure nodes 20, without using any of the nodes 10 indicated as insecure.
- Figure 2 shows operational steps according to an embodiment.
- a request for a new path with a desired level of security is received at the PCE, the security level indicating a level of protection against unauthorised physical access to the path.
- the PCE accesses the record of connectivity of nodes and links, and indications of security.
- the indications can relate to nodes or parts of nodes or links, or to multiplex channels through multiple nodes for example. Where there is no security information for part of the node or link, the default assumption may be that the node or part has the lowest level, in other words it is insecure.
- the PCE selects a new path for the traffic through the nodes from the ingress node to the egress node based on the connectivity and on the indications of security levels. If the indications are of security capability only, without current security status, then it would be possible to check the security status later, for example when communicating with the nodes to set up the path. This might enable the amount of data in the record to be reduced and the amount of communications overhead involved in maintaining the record to be reduced.
- Figure 3 shows steps similar to those of figure 2 according to another embodiment with current security level updates.
- step 190 at least some of the nodes pass their current security level or levels to the record to update the indications of security level in the record for use by the PCE. This can happen for example when there is a change in level for any reason, such as an upgrade or a detection of tampering. Or it can happen periodically when the record polls the nodes for example.
- step 202 a request for a new path with a desired level of security is received at the PCE, the security level indicating a level of protection against unauthorised physical access to the path. In some networks this can be implemented as a path computation request PCreq message with a flag set to indicate there is a desired security level.
- the PCE accesses the record of connectivity of nodes and links, and indications of security.
- the indications can relate to nodes or parts of nodes or links, or to multiplex channels through multiple nodes for example.
- the default assumption may be that the node or part has the lowest level, in other words it is insecure.
- the PCE selects a new path for the traffic through the nodes from the ingress node to the egress node based on the connectivity and on the indications of security levels, so as to use only security enabled nodes such as the nodes 20 of figure 1 .
- Figure 4 shows steps similar to those of figure 3 according to another embodiment with multiple security levels and current security level updates.
- some nodes or each node determines a current level of security for a part or for all of the node.
- Other layers can be envisaged.
- at least some of the nodes pass their current security level or levels to the record to update the indications of security level in the record for use by the PCE. This can happen for example when there is a change in level for any reason, such as an upgrade or a detection of tampering.
- a request for a new path with a desired level of security is received at the PCE, the security level indicating a level of protection against unauthorised physical access to the path.
- the PCE accesses the record of connectivity of nodes and links, and indications of security.
- the indications can relate to nodes or parts of nodes or links, or to multiplex channels such as wavelengths of a wavelength multiplexed network.
- the PCE selects a new path for the traffic through the nodes from the ingress node to the egress node based on the connectivity and on the indications of security levels, and the desired security level, so as to use only security enabled nodes such as the nodes 20 of figure 1 .
- Figure 5 shows steps similar to those of figure 3 according to another embodiment with wavelength allocation.
- a request for a new path with a desired level of security is received at the PCE, the security level indicating a level of protection against unauthorised physical access to the path.
- the PCE accesses the record of connectivity of nodes and links, and indications of security.
- the indications can relate to nodes or parts of nodes or links, or to multiplex channels through multiple nodes for example. Where there is no security information for part of the node or link, the default assumption may be that the node or part has the lowest level, in other words it is insecure.
- the PCE selects a new path for the traffic through the nodes from the ingress node to the egress node based on the connectivity and on the indications of security levels.
- a channel allocation is made from available ones of the wavelength multiplexed channels. These can be wavelengths or bands in a flex grid type optical network for example.
- Figure 6 shows steps similar to those of figure 2 according to another embodiment with validation of security level during path set up.
- a request for a new path with a desired level of security is received at the PCE.
- the PCE accesses the record of connectivity of nodes and links, and indications of security. The indications can relate to nodes or parts of nodes or links.
- the PCE selects a new path for the traffic through the nodes from the ingress node to the egress node based on the connectivity and on the indications of security levels.
- the selected path is set up through the nodes of the network. This can be controlled centrally by the NMS or locally the ingress node for example.
- a validation process can take place to check that the security level is still high enough to match the desired security level. This can involve comparing the desired level to the internal record at the node of its current security level. The comparison can take place at each node and the result be sent back to the ingress node, or the current security level can be sent from the node to the ingress node and the comparison can be done there.
- the security levels of constituent parts of the chosen path can be reported to the NMS. This can be reports of changes in level, or periodic reports to reassure the NMS that the security monitoring and communication paths are still working.
- Figure 7 shows a schematic view of some parts for one possible implementation of a secure node 20 of an optical network, for use with the embodiments described.
- a security monitoring part 31 is provided.
- the node has an optical branching part 15 provided in the form of a splitter or demultiplexer for example, coupled to incoming optical paths. Outputs of the branching part are fed to other output ports or to output multiplexers 40 which can selectively block or pass wavelengths. One of these paths leads to an unused output port 25.
- the security level monitoring part has a blocking part 50 which occupies the unused port so as to prevent unauthorised access to the optical path of the unused port.
- An optical detector 60 is provided coupled to the blocking part and configured to detect optical signals passing through the unused port.
- the security monitoring part also has circuitry 70 coupled to the optical detector and configured to compare levels for validation of security levels or process signals to report changes in security level for example, or to output an alarm signal indicative that the unused port has been accessed based on the detecting of the optical signals by the optical detector, via an interface 32 with the control plane.
- a software guard 48 is also coupled to the circuitry 70. This software guard is part of a control part 45 for controlling the output multiplexers 40 to control which of the distributed optical signals are to be blocked and which are to be passed.
- the circuitry can be implemented as a processor configured to execute programs in the form of software or firmware. It can be shared with other functions by time slicing, or be a dedicated processor for the security level monitoring part for example.
- the proposed security monitoring part (which can be a card fitted into the main equipment, or an active frame housed in a pizza box likewise for example) can have optical detectors implemented as a set of photodiodes to be connected to blocking parts in the form of optical connectors for example to connect to the open unsecure ports of a ROADM node. Any opening of such connections for malicious purposes will be instantaneously detected, and an alarm signal can be sent to enable network operators to take opportune counter measures.
- This method or apparatus can be applied to current equipment or installed legacy equipment since it can be based on a new add-on unit which does not require changes in the developed equipment cards. Furthermore the unit can be based on low cost devices and simple low speed electronics and control. This is pertinent to ITU-T X.805, addressing non repudiation and access control security dimensions, and the security management plane.
- the security monitoring part can communicate this information, for example indicating the security capability and its current status to the network control and management for any appropriate response, such as warning a human operator, or rerouting sensitive traffic, or updating a routing database for example.
- Figure 8 shows a schematic view of parts of apparatus in the form of a node according to another embodiment in which the security monitoring system is applied to a traditional Colored/Directionbound ROADM node.
- One bidirectional optical link (line 1) is shown to and from another node, many other such lines may be provided.
- Optical amplifiers 510 are provided as input and output interfaces. Monitoring outputs of these amplifiers are fed to the security monitoring system.
- a splitter 550 splits the incoming optical signal which is typically a WDM signal into 9 identical copies (there may be more or fewer copies in other examples).
- AWG 500 which separates the n individual wavelengths of the WDM signals and couples each wavelength to a different transponder (TP 1...n) which then outputs an electrical signal to a local client interface.
- TP 1...n a different transponder
- the AWG may not have the "right" number of outputs to match the desired number of transponders, there may be a number of spare outputs which are unused ports. These are coupled to the security monitoring system so that they are occupied and not vulnerable to unauthorised, undetected eavesdropping.
- the splitter has 8 other outputs as shown. Four of these are fed to other lines and so are "used”. Another four are unused and so are fed to the security monitoring system so that they are occupied and not vulnerable to unauthorised, undetected eavesdropping. Hence the security monitoring system as shown occupies all the unused monitoring ports, unused splitter ports, and unused demultiplexer drop ports.
- the transponders also have incoming signals which are for adding to the WDM signals sent to the other nodes. These are coupled as individual wavelengths from the transponders to AWG multiplexer 505.
- This AWG has a number of unused input ports. These are not shown as being occupied or monitored, but in another example, if there was any risk of these being used to insert unwanted interfering signals, the security monitoring system could occupy and monitor these input ports also.
- the WDM "add" signal from multiplexer 505 is fed to a WSS 540 which selects which wavelengths of the "add” signal are sent out on line 1 together with other wavelengths from other lines.
- the output WDM signal from WSS 540 is fed to an optical amplifier 510 for transmission to the next node. Parts 510, 550 and 540 can be provided for each of the lines served by the node.
- the security monitoring system can be arranged to indicate to the network management system which of the lines are secure.
- a subset of the wavelengths can be protected by occupying all the unused monitoring ports, all the unused splitter ports, but only selected ones of the drop ports corresponding to the subset of wavelengths.
- the security monitoring system can be arranged to indicate to the network management system which of the wavelengths are secure.
- all the unused ports of the entire node can be occupied and monitored by the security monitoring system.
- Other variations can be envisaged such as applying a similar security monitoring system to a more advanced colorless/directionless architecture of ROADM.
- an optical LSP is requested between a couple of nodes in a WSON network.
- a conventional routing procedure would find the shortest path, according to a given objective function.
- the proposed method forces the routing engine to find a route based on security information, for example using only security enabled nodes, or prioritising such nodes.
- a PCE is devoted to path computation, including wavelength assignment and physical validation. It is aware of the security capabilities of each node of the network.
- PCE PCE communication protocol
- path computation requests i.e., using a PCEP PCReq message
- the flag is set to "1" if a secured channel is requested. Otherwise is set to "0".
- PCE works on the traffic engineering database with updated information about the availability of the security certified resources.
- the PCE performs path computation depending on all the conventional parameters like the bit-rate, the admitted modulation formats, the available wavelengths along the path. In addition, if the security flag is set to "1", only the security enabled ROADMs are considered. This could force the PCE to calculate a path which is not the shortest one because the security request has the priority on other requirements like the minimization of the cost or of the length.
- a negative feedback is sent to the owner of the traffic demand by setting the flag to "0" in the PCEP response from the PCE to s.
- the owner of the traffic demand can choose to request a not secured lightpath and provide the desiderated security at a higher layer (e.g. at packet level) or consider other options.
- the backup path shall be secured.
- a Security Label Set can be defined to gather secure wavelength availability information.
- the end to end availability of a secure channel is assessed during the signalling phase so that the ingress node becomes aware of such availability thanks to the RESV messages. More explanation and examples will be described with reference to figures 9 to 11 .
- Figure 9 shows steps in validating a security level along a path during set up of the path according to an embodiment. This may be carried out after the path has been selected based on the security levels, or it may take place after a path computation which was based on connectivity, with no security level information.
- Step 400 shows initiating the set up of the chosen path through the nodes. This may be controlled centrally by the NMS or locally by the ingress node for example.
- a request is sent to nodes along the path to indicate their level of security against physical access to the path for eavesdropping or tampering in any way.
- the indicated security levels are compared with the desired level for the new path to validate the new path.
- This comparison can take place anywhere in principle, though it is usually convenient to carry it out at the ingress node or at each node along the path. If the comparison fails, if the node security level is not high enough then the path set up fails and usually a new path request is sent to the PCE, possibly along with an indication to avoid the node that failed the comparison.
- Figure 10 shows a sequence chart for a path set up procedure with comparison at an ingress node. Again this may be carried out after the path has been selected based on the security levels, or it may take place after a path computation which was based on connectivity, with no security level information. Time flows down the page.
- a left column shows actions at an ingress node
- a middle column shows actions at one of many intermediate nodes along the path
- a right column shows actions of an egress node.
- a request for path set up is received from the PCE, usually with a list of nodes of the path.
- the ingress node sends to the next node along the path an RSVP path message requesting a path set up with a report of a level of security of each node.
- the next node sends back an acknowledgement and passes the path message to the next node.
- a retry is carried out several times.
- the intermediate node checks its security level for the node or for parts of the node on the chosen path.
- the egress node receives the path message and determines its current level of security.
- the egress node returns a RESV message at step 436 back along the path towards the ingress node, with the security level indication.
- the egress node sets up the chosen path at the egress node.
- the intermediate node receives the RESV message and does the same, passing on the RESV message with a security indication and setting up the path at step 439.
- the ingress node receives the RESV message at step 440 and compares the desired level of security with the security level indications received from the other nodes of the path. This validates the path, if all the indicated security levels are as high or higher than the desired level.
- the ingress node allows traffic to pass along the path at step 441 if the path is validated.
- Figure 11 shows a sequence chart similar to that of figure 10 but for a path set up procedure with the comparison made at each node along the path, instead of at the ingress node. Again this may be carried out after the path has been selected based on the security levels, or it may take place after a path computation which was based on connectivity, with no security level information. Time flows down the page.
- a left column shows actions at an ingress node
- a middle column shows actions at one of many intermediate nodes along the path
- a right column shows actions of an egress node.
- a request for path set up is received from the PCE, usually with a list of nodes of the path.
- the ingress node sends to the next node along the path an RSVP path message requesting a path set up with a report of a level of security of each node.
- the next node sends back an acknowledgement and passes the path message to the next node.
- a retry is carried out several times.
- the intermediate node checks its security level for the node or for parts of the node on the chosen path. At the intermediate node the comparison is carried out at step 445 between the current security level and the desired level.
- the egress node receives the path message and determines its current level of security.
- the comparison is carried out at step 445 between the current security level and the desired level.
- the egress node then returns a RESV message at step 446 back along the path towards the ingress node, with the security level indication in the form of a result of the comparison, in other words a comparative security level indication, either meeting or failing the comparison.
- the egress node sets up the chosen path at the egress node, as long as the validation was successful.
- the intermediate node receives the RESV message and does the same, passing on the RESV message with its comparative security indication and setting up the path at step 439 if the validation is successful.
- the ingress node receives the RESV message at step 449 and checks that successful comparative security level indications have been received from the other nodes of the path. This validates the path, if all the comparative security levels are positive. At step 441 the ingress node allows traffic to pass along the path at step 441 if the path is validated.
- Figure 12 shows steps in a method of updating the record of levels of security according to an embodiment.
- the procedure is started periodically, although it can also be started whenever a security level changes at a node.
- the current level of security is detected at each node.
- an indication of the current level is sent from each node to the centrally located record. This can be communicated using the control plane if the network has a control plane.
- the centrally located record receives the indications and updates the stored values.
- the ROADM has the required security capability, it's able to communicate this information to the network control in any manner, one example is by setting a flag.
- the security could be provided and monitored or enforced for a part of the node capacity or for a subset of the available directions. In this case multiple parameters would be necessary to communicate for which wavelength and/or for which directions the security is available.
- various different ways of addressing node security against physical access to the paths have been presented. If all the possible security measures (hardware and software) are operating in a node, the node can be considered "fully security certified" and eligible for routing of more sensitive traffic. Note that, if a node does not have all the security measures against physical access in place, it could be considered secure by hosting the node in a secure building. In this case the security flag described in the following could still be set to "1".
- the embodiments described can allow many possible node security weaknesses to be summarised in a common aggregated parameter to be used to certify the security of a path.
- an additional degree of security can be provided and added to the conventional Layer 2 and Layer 3 security methods.
- the security certification as described providing routing with validation of security against physical access to the path, does not interfere or replace security methods provided at the higher layers but can complement them.
- the method can exploit various specific node level protection solutions as described, but can also be applied to not-upgraded nodes (e.g. legacy configurations) by ensuring the security at the site level (building access control, etc). Also it is suitable for networks having either centralized or distributed control planes.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
- Optical Communication System (AREA)
Claims (15)
- Procédé de calcul de chemin à travers des noeuds d'un réseau de communications optique d'un noeud d'entrée à un noeud de sortie, afin de respecter un niveau de sécurité souhaité contre un accès physique non autorisé au chemin optique, le procédé comportant les étapes :de réception d'une demande (200) pour la sélection d'un nouveau chemin optique à travers les noeuds et les liaisons du réseau optique, à l'aide d'un enregistrement (210) d'une connectivité des noeuds et des liaisons et ayant des indications d'un niveau de sécurité associé à au moins certaines parties des noeuds et des liaisons, le niveau de sécurité étant indicatif de la sécurité contre un accès physique non autorisé au chemin optique,dans lequel le niveau de sécurité associé à un noeud est un niveau de sécurité actuel basé sur une surveillance du noeud pour détecter un accès physique non autorisé, etla sélection du chemin optique (220) en fonction au moins des indications du niveau de sécurité, et en fonction du niveau de sécurité souhaité pour le chemin optique.
- Procédé selon la revendication 1, comportant l'étape de transmission des mises à jour (190) des niveaux de sécurité actuels des noeuds à l'enregistrement pour mettre à jour l'enregistrement.
- Procédé selon une quelconque revendication précédente, au moins l'une des liaisons comportant des canaux multiplexés par division en longueur d'onde, et les indications d'un niveau de sécurité d'au moins certaines parties des noeuds et des liaisons comprenant une indication d'un niveau de sécurité d'au moins l'un des canaux multiplexés en longueur d'onde, et le procédé comportant l'étape d'attribution (230) d'un canal multiplexé en longueur d'onde en fonction des indications.
- Procédé selon une quelconque revendication précédente, comportant l'étape d'envoi, à un système de gestion de réseau (130), d'un rapport des niveaux de sécurité des parties constitutives du chemin choisi sur la base des indications, et/ou comportant l'étape d'envoi du trafic (441) le long du chemin optique sélectionné.
- Procédé selon une quelconque revendication précédente, comportant l'étape suivante d'établissement (240, 400, 410, 420, 431 à 440) du chemin choisi par l'envoi de messages aux noeuds le long du chemin, et la validation (240, 420, 445, 446, 448, 449) du niveau de sécurité au niveau d'au moins certains des noeuds situés le long du chemin.
- Procédé de validation d'un chemin optique choisi à travers des noeuds d'un réseau de communications optique d'un noeud d'entrée à un noeud de sortie, afin de respecter un niveau de sécurité souhaité pour le chemin contre un accès physique non autorisé au chemin, comportant les étapes :d'envoi d'une demande (410, 431, 432, 435, 436, 438, 440) à chacun des noeuds du chemin optique choisi pour indiquer un niveau de sécurité pour au moins une partie du chemin à travers ce noeud, le niveau de sécurité étant indicatif de la sécurité contre un accès physique non autorisé au chemin optique,dans lequel le niveau de sécurité associé à un noeud est un niveau de sécurité actuel basé sur une surveillance du noeud pour détecter un accès physique non autorisé, etde comparaison (420, 440, 445) des niveaux de sécurité indiqués pour les noeuds avec le niveau souhaité pour valider le chemin choisi.
- Procédé selon la revendication 6, comportant l'étape de transmission des niveaux de sécurité indiqués au noeud d'entrée, et de réalisation de la comparaison (440) au niveau du noeud d'entrée, ou comportant l'étape de réalisation de l'étape de comparaison au niveau du noeud respectif (445), et d'envoi (446, 448) du résultat de la comparaison au noeud d'entrée.
- Procédé selon l'une quelconque des revendications 6 à 7, la demande comprenant un message de chemin RSVP, et comportant l'étape d'envoi des indications de chaque noeud au noeud d'entrée à l'aide d'un message RESV.
- Procédé de signalement d'un niveau de sécurité actuel au niveau d'un noeud optique à un enregistrement d'une connectivité de noeuds et de liaisons d'un réseau de communications optique, l'enregistrement comportant également des indications de niveaux de sécurité associés à au moins certaines parties des noeuds et des liaisons, le procédé comportant les étapes :de détection, au niveau du noeud optique (460), d'un niveau de sécurité actuel contre un accès physique non autorisé à des parties d'un chemin à travers le noeud, le niveau de sécurité actuel étant basé sur une surveillance du noeud pour détecter un accès physique non autorisé, etd'envoi, à l'enregistrement, d'une indication (470) du niveau de sécurité actuel détecté, pour la mise à jour (480) de l'enregistrement avec le niveau de sécurité actuel.
- Procédé selon une quelconque revendication précédente, dans lequel l'un des niveaux de sécurité comprend le fait d'indiquer si le noeud respectif comporte un dispositif de protection (48) fonctionnant pour empêcher une reconfiguration non autorisée d'un port de sortie du noeud afin de laisser fuir un signal optique qui est diffusé par le noeud sur tous les ports de sortie et normalement bloqué au niveau de tous les ports de sortie sauf un souhaité, et/ou dans lequel le réseau est un réseau optique, et l'un des niveaux de sécurité comprend le fait d'indiquer si le noeud respectif comporte un bloc physique (50) fonctionnant pour empêcher un accès non autorisé à un chemin optique d'un port de sortie disponible (25) vers lequel un signal optique est normalement diffusé.
- Procédé selon l'une quelconque des revendications précédentes, le réseau comportant au moins une liaison comportant des canaux multiplexés par division en longueur d'onde, et l'indication d'un niveau de sécurité comprenant une indication d'un niveau de sécurité d'au moins l'un des canaux multiplexés en longueur d'onde.
- Appareil (10, 20) pour un réseau de communications optique, configuré pour mettre en oeuvre le procédé selon l'une quelconque des revendications 1 à 5, ou la revendication 9 ou les revendications 10 ou 11 lorsqu'elles dépendent de l'une quelconque des revendications 1 à 5 et 9.
- Noeud (10, 20) d'un réseau de communications optique configuré pour coopérer avec un élément de calcul de chemin distant pour valider un chemin optique choisi à travers des noeuds du réseau de communications, d'un noeud d'entrée à un noeud de sortie, afin de respecter un niveau de sécurité souhaité pour le chemin contre un accès physique non autorisé au chemin, le noeud comportant :une partie de surveillance de niveau de sécurité (30, 31) configurée pour surveiller le noeud afin de détecter un accès physique non autorisé indiquant un niveau actuel de sécurité contre un accès physique non autorisé à des parties du chemin choisi à travers le noeud,une partie interface (32) configurée pour recevoir une demande, en provenance de l'élément de calcul de chemin, d'une indication du niveau de sécurité actuel pour au moins une partie du chemin choisi à travers ce noeud, et configurée pour envoyer l'indication à l'élément de calcul de chemin en réponse à la demande.
- Noeud selon la revendication 13, comportant un comparateur (70) configuré pour comparer le niveau actuel de sécurité avec le niveau souhaité en réponse à la demande, et la partie interface étant configurée pour envoyer le résultat de la comparaison en tant qu'indication du niveau actuel de sécurité pour cette partie du chemin choisi et/ou, la demande comprenant un message de chemin RSVP, et le noeud étant configuré pour envoyer l'indication par l'envoi d'un message RESV au noeud d'entrée.
- Signal comportant une indication d'un niveau de sécurité d'un chemin optique d'un noeud d'entrée à un noeud de sortie dans un réseau de communications optique comportant des noeuds et des liaisons, le niveau de sécurité étant associé à un noeud et étant indicatif de la sécurité contre un accès physique non autorisé sur au moins une partie du chemin optique, pour espionner ou altérer le chemin optique, et étant basé sur une surveillance du noeud pour détecter un accès physique non autorisé.
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
PCT/EP2012/060995 WO2013185796A1 (fr) | 2012-06-11 | 2012-06-11 | Utilisation de niveaux de sécurité dans un réseau optique |
Publications (2)
Publication Number | Publication Date |
---|---|
EP2859673A1 EP2859673A1 (fr) | 2015-04-15 |
EP2859673B1 true EP2859673B1 (fr) | 2019-06-05 |
Family
ID=46229513
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
EP12726454.7A Not-in-force EP2859673B1 (fr) | 2012-06-11 | 2012-06-11 | Utilisation de niveaux de sécurité dans un réseau optique |
Country Status (3)
Country | Link |
---|---|
US (1) | US20150128223A1 (fr) |
EP (1) | EP2859673B1 (fr) |
WO (1) | WO2013185796A1 (fr) |
Families Citing this family (14)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
EP3011690B1 (fr) * | 2013-06-18 | 2017-05-31 | Telefonaktiebolaget LM Ericsson (publ) | Surveillance optique dans un réseau de communications optique |
CN104253750B (zh) * | 2013-06-26 | 2018-10-09 | 华为技术有限公司 | 路径获取方法、路径计算单元、路径计算客户端及系统 |
US9729455B2 (en) | 2014-06-30 | 2017-08-08 | Juniper Networks, Inc. | Multi-protocol label switching rings |
US10218611B2 (en) | 2014-06-30 | 2019-02-26 | Juniper Networks, Inc. | Label distribution protocol (LDP) signaled multi-protocol label switching rings |
US9692693B2 (en) * | 2014-06-30 | 2017-06-27 | Juniper Networks, Inc. | Bandwidth control for ring-based multi-protocol label switched paths |
GB2544049A (en) * | 2015-11-03 | 2017-05-10 | Barco Nv | Method and system for optimized routing of data streams in telecommunication networks |
US10397190B2 (en) * | 2016-02-05 | 2019-08-27 | Huawei Technologies Co., Ltd. | System and method for generating an obfuscated optical signal |
US11362936B2 (en) | 2016-07-19 | 2022-06-14 | Telefonaktiebolaget Lm Ericsson (Publ) | Datapath provision in software defined networks |
ES2809719T3 (es) | 2016-09-07 | 2021-03-05 | Procter & Gamble | Una composición detergente líquida para lavado de ropa que comprende un primer polímero y un segundo polímero |
EP3293250A1 (fr) | 2016-09-07 | 2018-03-14 | The Procter & Gamble Company | Composition de détergent liquide comprenant des polymères cellulosiques et de la cellulase |
JP6847885B2 (ja) * | 2018-03-20 | 2021-03-24 | 株式会社東芝 | 情報処理装置、情報処理方法及びプログラム |
US11233748B1 (en) | 2018-08-30 | 2022-01-25 | Juniper Networks, Inc. | Bandwidth management for resource reservation label switched path of a ring network |
US11785053B2 (en) * | 2019-04-04 | 2023-10-10 | Cisco Technology, Inc. | Systems and methods for determining secure network paths |
US11916902B2 (en) * | 2021-02-25 | 2024-02-27 | Fortinet, Inc. | Systems and methods for using a network access device to secure a network prior to requesting access to the network by the network access device |
Family Cites Families (7)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US6219161B1 (en) * | 1999-01-25 | 2001-04-17 | Telcordia Technologies, Inc. | Optical layer survivability and security system |
US7236597B2 (en) * | 2002-12-20 | 2007-06-26 | Bbn Technologies Corp. | Key transport in quantum cryptographic networks |
WO2004064310A2 (fr) * | 2003-01-11 | 2004-07-29 | Omnivergent Communications Corporation | Reseau cognitif |
US7283741B2 (en) * | 2003-06-06 | 2007-10-16 | Intellambda Systems, Inc. | Optical reroutable redundancy scheme |
US7984294B1 (en) * | 2005-04-14 | 2011-07-19 | Avaya Inc. | Method and apparatus for trust based routing in data networks |
EP1900120A2 (fr) * | 2005-06-06 | 2008-03-19 | Intellambda Systems, Inc | Qualite de service dans un reseau optique |
EP2540013B1 (fr) | 2010-02-26 | 2016-06-29 | Telefonaktiebolaget LM Ericsson (publ) | Surveillance optique dans élément de réseau de communication |
-
2012
- 2012-06-11 EP EP12726454.7A patent/EP2859673B1/fr not_active Not-in-force
- 2012-06-11 US US14/406,907 patent/US20150128223A1/en not_active Abandoned
- 2012-06-11 WO PCT/EP2012/060995 patent/WO2013185796A1/fr active Application Filing
Non-Patent Citations (1)
Title |
---|
None * |
Also Published As
Publication number | Publication date |
---|---|
US20150128223A1 (en) | 2015-05-07 |
EP2859673A1 (fr) | 2015-04-15 |
WO2013185796A1 (fr) | 2013-12-19 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
EP2859673B1 (fr) | Utilisation de niveaux de sécurité dans un réseau optique | |
EP2564532B1 (fr) | Systèmes et procédés de découverte automatique de topologie de n ud multiplexeur d'insertion-extraction optique reconfigurable | |
US20190158940A1 (en) | Procedures, apparatuses, systems, and computer programs for providing optical network channel protection | |
EP2051442B9 (fr) | Procédé, système et appareil pour protéger une transmission à multiplexage par répartition en longueur d'onde | |
US9553881B2 (en) | Security monitoring for optical network | |
US20160365931A1 (en) | Remote node configuration for providing upgraded services in a passive optical network and a passive optical network having the same | |
EP2494726B1 (fr) | Perfectionnements apportés à des réseaux de communication optiques | |
Lee et al. | Routing and wavelength assignment information model for wavelength switched optical networks | |
US9780868B2 (en) | Security monitoring for optical network | |
US8923698B2 (en) | Spectrum efficient optical transport system with superchannels | |
Ab-Rahman et al. | OXADM restoration scheme: Approach to optical ring network protection | |
US11088775B2 (en) | Subcarrier diversity in optical communication systems | |
US20090074418A1 (en) | Self checking optical add drop multiplexer | |
US20090080892A1 (en) | Network apparatus and method for guaranteeing role of optical supervisory channel | |
Xu et al. | Emergency optical network construction and control with multi-vendor interconnection for quick disaster recovery | |
KR20140073538A (ko) | 수동 광 네트워크에 연결된 노드들을 상호접속하기 위한 시스템 | |
Hayashi et al. | Highly reliable optical bidirectional path switched ring networks applicable to photonic IP networks | |
US20020109877A1 (en) | Network management architecture | |
ES2754396T3 (es) | Método, sistema y dispositivo de nodo para establecer una interconexión de longitud de onda | |
US7146101B2 (en) | Optical media management channel | |
KR20140061100A (ko) | 통신 장애 복구 방법 및 그를 위한 환형 네트워크 | |
JP2012104961A (ja) | 光通信システム、光信号伝送方法及び光伝送装置 | |
Feng et al. | A multi-wavelength ring network based on GMPLS | |
CA2426857A1 (fr) | Reseau de communication optique et noeud pour former un tel reseau | |
Jones et al. | Attributes of the Next Generation Sprint Optical Transport Network |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
PUAI | Public reference made under article 153(3) epc to a published international application that has entered the european phase |
Free format text: ORIGINAL CODE: 0009012 |
|
17P | Request for examination filed |
Effective date: 20141210 |
|
AK | Designated contracting states |
Kind code of ref document: A1 Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR |
|
AX | Request for extension of the european patent |
Extension state: BA ME |
|
DAX | Request for extension of the european patent (deleted) | ||
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: EXAMINATION IS IN PROGRESS |
|
17Q | First examination report despatched |
Effective date: 20170612 |
|
REG | Reference to a national code |
Ref country code: DE Ref legal event code: R079 Ref document number: 602012060702 Country of ref document: DE Free format text: PREVIOUS MAIN CLASS: H04J0014020000 Ipc: H04L0012717000 |
|
RIC1 | Information provided on ipc code assigned before grant |
Ipc: H04L 12/717 20130101AFI20181217BHEP Ipc: H04L 29/06 20060101ALI20181217BHEP Ipc: H04J 14/02 20060101ALI20181217BHEP |
|
GRAP | Despatch of communication of intention to grant a patent |
Free format text: ORIGINAL CODE: EPIDOSNIGR1 |
|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: GRANT OF PATENT IS INTENDED |
|
INTG | Intention to grant announced |
Effective date: 20190201 |
|
GRAS | Grant fee paid |
Free format text: ORIGINAL CODE: EPIDOSNIGR3 |
|
GRAA | (expected) grant |
Free format text: ORIGINAL CODE: 0009210 |
|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: THE PATENT HAS BEEN GRANTED |
|
AK | Designated contracting states |
Kind code of ref document: B1 Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR |
|
REG | Reference to a national code |
Ref country code: GB Ref legal event code: FG4D |
|
REG | Reference to a national code |
Ref country code: CH Ref legal event code: EP |
|
REG | Reference to a national code |
Ref country code: AT Ref legal event code: REF Ref document number: 1141114 Country of ref document: AT Kind code of ref document: T Effective date: 20190615 |
|
REG | Reference to a national code |
Ref country code: DE Ref legal event code: R096 Ref document number: 602012060702 Country of ref document: DE |
|
REG | Reference to a national code |
Ref country code: IE Ref legal event code: FG4D |
|
REG | Reference to a national code |
Ref country code: NL Ref legal event code: MP Effective date: 20190605 |
|
REG | Reference to a national code |
Ref country code: LT Ref legal event code: MG4D |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: AL Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20190605 Ref country code: LT Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20190605 Ref country code: FI Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20190605 Ref country code: ES Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20190605 Ref country code: SE Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20190605 Ref country code: NO Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20190905 Ref country code: HR Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20190605 |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: LV Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20190605 Ref country code: BG Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20190905 Ref country code: GR Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20190906 Ref country code: RS Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20190605 |
|
REG | Reference to a national code |
Ref country code: AT Ref legal event code: MK05 Ref document number: 1141114 Country of ref document: AT Kind code of ref document: T Effective date: 20190605 |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: PT Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20191007 Ref country code: RO Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20190605 Ref country code: AT Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20190605 Ref country code: CZ Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20190605 Ref country code: NL Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20190605 Ref country code: EE Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20190605 Ref country code: SK Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20190605 |
|
REG | Reference to a national code |
Ref country code: CH Ref legal event code: PL |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: IT Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20190605 Ref country code: IS Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20191005 Ref country code: SM Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20190605 |
|
REG | Reference to a national code |
Ref country code: DE Ref legal event code: R097 Ref document number: 602012060702 Country of ref document: DE |
|
REG | Reference to a national code |
Ref country code: BE Ref legal event code: MM Effective date: 20190630 |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: TR Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20190605 Ref country code: MC Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20190605 |
|
PLBE | No opposition filed within time limit |
Free format text: ORIGINAL CODE: 0009261 |
|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: NO OPPOSITION FILED WITHIN TIME LIMIT |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: DK Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20190605 Ref country code: PL Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20190605 Ref country code: IE Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES Effective date: 20190611 |
|
26N | No opposition filed |
Effective date: 20200306 |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: SI Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20190605 Ref country code: LU Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES Effective date: 20190611 Ref country code: BE Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES Effective date: 20190630 Ref country code: LI Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES Effective date: 20190630 Ref country code: CH Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES Effective date: 20190630 |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: CY Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20190605 |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: HU Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT; INVALID AB INITIO Effective date: 20120611 Ref country code: MT Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20190605 |
|
REG | Reference to a national code |
Ref country code: DE Ref legal event code: R079 Ref document number: 602012060702 Country of ref document: DE Free format text: PREVIOUS MAIN CLASS: H04L0012717000 Ipc: H04L0045420000 |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: MK Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20190605 |
|
PGFP | Annual fee paid to national office [announced via postgrant information from national office to epo] |
Ref country code: GB Payment date: 20220628 Year of fee payment: 11 |
|
PGFP | Annual fee paid to national office [announced via postgrant information from national office to epo] |
Ref country code: FR Payment date: 20220627 Year of fee payment: 11 |
|
PGFP | Annual fee paid to national office [announced via postgrant information from national office to epo] |
Ref country code: DE Payment date: 20220629 Year of fee payment: 11 |
|
REG | Reference to a national code |
Ref country code: DE Ref legal event code: R119 Ref document number: 602012060702 Country of ref document: DE |
|
GBPC | Gb: european patent ceased through non-payment of renewal fee |
Effective date: 20230611 |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: DE Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES Effective date: 20240103 Ref country code: GB Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES Effective date: 20230611 |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: FR Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES Effective date: 20230630 |